I have different idea.
putting validation responsibility on ORM makes same fault as before.
I wish keeping ORM as just handy interface for mainly RDBs.
And Model should be more high-level layer for external service, composite multiple data, backend job etc,
If Model will stay on Cake3 and have responsibility of Validation and handling ORM with Table/Entitiy,
we finally get truly abstruct Model layer and transparency with old versions.

I say again, ORM should have data manipulation like you said. But Validation is not primary responsibility for ORM as I feel now.
if we have isolated Model, we can use Validation feature for fields not coming from or going to db.
it may look similar with Form classes on symfony family.